Suricata

Reproduce with

diff --git a/tests/bug-2576-02/suricata.yaml b/tests/bug-2576-02/suricata.yaml
index 1e40c3aa..631ddad2 100644
--- a/tests/bug-2576-02/suricata.yaml
+++ b/tests/bug-2576-02/suricata.yaml
@@ -53,6 +53,15 @@ outputs:
         header: X-Forwarded-For

       types:
+        - anomaly:
+            enabled: yes
+            #
+            # Choose one or more types of anomaly logging and whether to enable
+            # logging of the packet header for packet anomalies.
+            types:
+              # decode: no
+              stream: yes
+              # applayer: yes
         - alert:
             # payload: yes             # enable dumping payload in Base64
             # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log

and jq .anomaly output/eve.json